Crédit Mutuel Arkéa discloses $133 million attack estimate

By Amara Osei

On November 4, Crédit Mutuel Arkéa disclosed a cyberattack in which a service-provider route enabled fraudulent transactions that blockchain fraud investigator ZachXBT estimates may have reached €118 million ($133 million). The French banking group has more than 5.8 million members and €211.5 billion in assets.

What happened before the disclosure?

Public reports first appeared on November 2 from ZachXBT, who warned of a large-scale unauthorized withdrawal from multiple centralized exchange accounts. He said the activity had occurred a day earlier, on November 1, but did not identify the affected entity.

ZachXBT estimated that the attacker might have taken as much as €118 million ($133 million) and withdrawn it in USDC and USDT stablecoins. By November 3, he said, $30 million—nearly one-quarter of the $133 million upper estimate—had been laundered.

He attributed that speed to the absence of public disclosure and said EU law enforcement would otherwise have frozen the money. The delay gave the attacker time to move funds before the targeted institution issued a public warning.

On November 4, Arkéa said the incident “is now closed and under control.” It also said it had responded by suspending certain systems and that operations were gradually returning to normal.

Takeaway: The disclosure followed a two-day sequence in which suspected proceeds moved before the bank began restoring normal service.

What did the bank confirm?

Asked whether €118 million ($133 million) had been stolen, the bank answered: “We do not confirm this information and can only validate the order of magnitude.” Arkéa called the amount significant, said some funds were blocked, ruled out human error and described the event as a sophisticated attack.

The bank therefore accepts the general scale of ZachXBT’s estimate without confirming the precise loss, the total amount blocked or a final accounting of the missing money.

Takeaway: Arkéa confirmed a major attack and a significant exposure, but stopped short of confirming a final loss figure.

How did the attacker reach and move the money?

Arkéa’s account of the mechanism separates the intrusion route from the movement of funds:

• Entry point: A service provider’s platform, which the bank did not name; the bank ruled out Fortuneo.
• Network access: The attacker reached Arkéa’s network directly through that platform.
• Transaction source: Arkéa’s own account, not a customer account.
• Counterparties: Other banking institutions that received the fraudulent transactions.
• Asset conversion: The attacker converted the funds into cryptocurrency.

The disclosed sequence places service-provider access at the start and bank-controlled transaction authority at the center. The attacker did not use a customer account to initiate the transfers, and Arkéa said customer assets remained unaffected.

Takeaway: The stated attack chain ran through an unnamed service provider and the bank’s own account rather than customer balances.

What risks do customers face now?

Arkéa said the incident had no effect on customer assets across its federations and subsidiaries. Its practical impact was a delay in executing certain transfer transactions while the bank restored normal operations.

The lender also warned of increased phishing risk following the attack and issued three instructions:

• Treat unsolicited communications as potentially fraudulent.
• Do not share sensitive information by phone or email.
• Verify suspicious messages by calling a bank adviser directly.

Takeaway: Customers did not lose assets, but they now face a targeted phishing risk and should authenticate any bank contact independently.

What remains unresolved?

Arkéa said it is working with judicial authorities and police to establish the attack’s exact origin and modus operandi. Those inquiries have not yet produced a public account of how much money moved, how much remains blocked or which provider supplied the access route.

Further questions sent to Crédit Mutuel Arkéa had not received a response by publication, leaving its November 4 statement and FAQ as its most detailed public account.

Takeaway: Until investigators identify the provider and quantify the money moved and blocked, the €118 million figure remains an estimate rather than a settled loss.